Principles of Risk Management
Principles of risk management
The MoR principles are the enduring rules that make risk management effective. They are not a checklist to apply once; they are criteria for judging whether risk management is fit for purpose. The principles are: risk management aligns with objectives; fits the context; engages stakeholders; provides clear guidance; informs decision-making; facilitates continual improvement; and creates a supportive culture. Focus on their meaning and application rather than memorising a list without context.
What each principle demands
- Aligns with objectives: risk activity must connect to what the organisation is trying to achieve; irrelevant risks should be removed or de-scoped.
- Fits the context: the approach must suit the organisation's size, sector, complexity and regulatory environment.
- Engages stakeholders: those affected or accountable should be involved in identifying, assessing and responding to risk.
- Provides clear guidance: roles, processes, scales and escalation routes should be unambiguous.
- Informs decision-making: risk information should reach decision-makers in time and in a usable form.
- Facilitates continual improvement: lessons should feed back into the approach and process.
- Creates a supportive culture: leaders should reward openness and proportionate risk-taking, not blame.
Worked example
A risk workshop produces 200 risks, many about office car parking. The project objective is regulatory compliance. Applying aligns with objectives, the facilitator removes or downgrades irrelevant items and reframes the register around compliance milestones. The reasoning is that the principle tests relevance, not volume.
Traps
- Reciting principles without applying them to a scenario.
- Thinking principles are sequential steps.
- Confusing fits the context with one size fits all.